Merge pull request #560 from Slamdunk/jwt_5

Add support for lcobucci/jwt:v5
psr7-sessions · Feb 26, 2023 · 480cf58 · 480cf58
2 parents 77351b9 + 8041220
commit 480cf58
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 31 deletions.
diff --git a/composer.json b/composer.json
@@ -24,7 +24,7 @@
         "php":                             "~8.1.0 || ~8.2.0",
         "ext-json":                        "*",
         "dflydev/fig-cookies":             "^3.0.0",
-        "lcobucci/jwt":                    "^4.3.0",
+        "lcobucci/jwt":                    "^4.3.0 || ^5.0.0",
         "lcobucci/clock":                  "^3.0.0",
         "psr/http-message":                "^1.0.1",
         "psr/http-server-handler":         "^1.0.1",

diff --git a/composer.lock b/composer.lock
diff --git a/src/Storageless/Http/SessionMiddleware.php b/src/Storageless/Http/SessionMiddleware.php
@@ -148,8 +148,13 @@ private function parseToken(Request $request): UnencryptedToken|null
             return null;
         }
 
+        $cookie = $cookies[$cookieName];
+        if ($cookie === '') {
+            return null;
+        }
+
         try {
-            $token = $this->config->parser()->parse($cookies[$cookieName]);
+            $token = $this->config->parser()->parse($cookie);
         } catch (InvalidArgumentException) {
             return null;
         }

diff --git a/test/StoragelessTest/Http/SessionMiddlewareTest.php b/test/StoragelessTest/Http/SessionMiddlewareTest.php
@@ -124,6 +124,7 @@ public function testInjectsSessionInResponseCookies(callable $middlewareFactory)
         $token = $this->getCookie($response)->getValue();
 
         self::assertIsString($token);
+        self::assertTrue($token !== '');
         $parsedToken = (new Parser(new JoseEncoder()))->parse($token);
         self::assertInstanceOf(Plain::class, $parsedToken);
         self::assertEquals(['foo' => 'bar'], $parsedToken->claims()->get('session-data'));
@@ -328,6 +329,20 @@ public function testWillIgnoreSignedTokensWithoutIssuedAt(callable $middlewareFa
         $this->ensureSameResponse($middleware, $unsignedToken, $this->emptyValidationMiddleware());
     }
 
+    /**
+     * @param callable(): SessionMiddleware $middlewareFactory
+     *
+     * @dataProvider validMiddlewaresProvider
+     */
+    public function testWillIgnoreRequestsWithEmptyStringCookie(callable $middlewareFactory): void
+    {
+        $middleware   = $middlewareFactory();
+        $expiredToken = (new ServerRequest())
+            ->withCookieParams([SessionMiddleware::DEFAULT_COOKIE => '']);
+
+        $this->ensureSameResponse($middleware, $expiredToken, $this->emptyValidationMiddleware());
+    }
+
     public function testWillRefreshTokenWithIssuedAtExactlyAtTokenRefreshTimeThreshold(): void
     {
         // forcing ourselves to think of time as a mutable value:
@@ -367,7 +382,7 @@ public function testWillRefreshTokenWithIssuedAtExactlyAtTokenRefreshTimeThresho
             ->getValue();
 
         self::assertIsString($tokenString);
-
+        self::assertTrue($tokenString !== '');
         $token = (new Parser(new JoseEncoder()))->parse($tokenString);
         self::assertInstanceOf(Plain::class, $token);
         self::assertEquals($now, $token->claims()->get(RegisteredClaims::ISSUED_AT), 'Token was refreshed');